CVE-2021-26084
CRITICALVulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V14 - Configuration Dependency management, component inventory
|
| Impact | Critical risk (CVSS 9.8, EPSS 94.4%). Mass automated exploitation began within days of disclosure. Cryptomining gangs, ransomware operators, and APT groups all exploited this vulnerability. Confluence often contains sensitive documentation and connects to internal systems. |
| Exploit ScenarioDerived | Automated scanners send crafted requests with OGNL injection payloads to internet-facing Confluence instances. The server evaluates the OGNL expression, executing commands that download and run cryptocurrency miners. More sophisticated actors install web shells for persistent access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 26, 2026
Confluence Server and Data Center contain an OGNL injection vulnerability allowing unauthenticated remote code execution, triggering mass exploitation campaigns for cryptocurrency mining and ransomware in September 2021.
Earlier versions of this analysis (1)
An OGNL injection vulnerability in Atlassian Confluence enables unauthenticated remote code execution through crafted requests. Mass exploitation began immediately after disclosure, targeting thousands of internet-facing instances.
RemediationAI
Upgrade Confluence immediately. Check for web shells and cryptominers. Review Confluence content for evidence of data exfiltration. Restrict external access to Confluence.
Affected ProductsAI
Confluence Server before 6.13.23 Confluence Server 6.14.0 before 7.4.11 Confluence Server 7.5.0 before 7.11.6 Confluence Server 7.12.0 before 7.12.5
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The CWE-917 OGNL (Object-Graph Navigation Language) injection allows attackers to inject OGNL expressions through user-controllable parameters. Confluence's Webwork framework evaluates these expressions server-side, enabling execution of arbitrary Java code and OS commands.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.
Executive ViewAI
Organizations using affected face critical risk from CVE-2021-26084 rated CVSS 9.8. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems. This vulnerability is actively exploited in the wild (KEV-listed) and requires immediate remediation. A patch is available and should be applied immediately given the critical severity.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Exploit-DB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
GitHub PoC